Safe memory scanning

Abstract

A kernel mode memory scanning driver for use in safely scanning loaded drivers in the memory of computer systems utilizing Windows® NT based operating systems, such as Windows® 2000, Windows® XP, and other operating systems utilizing the Windows® NT kernel base, for viruses. Prior to scanning the loaded drivers for viruses, the kernel mode memory scanning driver hooks a driver unload function of the operating system, and stalls any calls to the driver unload function to prevent the loaded drivers from being unloaded during scanning. After scanning is complete, any stalled calls to the driver unload function are released. In one embodiment, the kernel mode memory scanning driver is implemented as a Windows® NT 4.0 kernel mode memory scanning driver, and thus can be used on computer systems utilizing Windows® 2000 or Windows® NT without platform specific code.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]The present invention relates to the protection of computer systems. More particularly, the present invention relates to a method for scanning the memory of a computer system for viruses.[0003]2. Description of the Related Art[0004]Windows® NT and Windows® 2000 are 32-bit operating systems widely used on home and business computer systems. As such, virus writers are continually working to develop viruses that can attack and exploit these operating systems.[0005]Windows® NT and Windows® 2000 provide page-based virtual memory management schemes that permit programs to realize a 4 GB (gigabyte) virtual memory address space. When the computer system processor is running in virtual memory mode, all addresses are assumed to be virtual addresses and are translated, or mapped, to physical addresses in main memory each time the processor executes a new instruction to access memory.[0006]Conventionally, the 4 GB virtual memory ad...

AI Technical Summary

Benefits of technology

[0012]In accordance with one embodiment of the invention, a method for safely scanning the memory of computer systems for viruses, such as kernel mode driver viruses, is described. In one embodiment, the method prevents drivers loaded in the memory of a computer system from being unloaded during scanning for the viruses, and then permits the unload of the drivers after scanning is complete.

Problems solved by technology

User mode code typically does not have direct access to kernel mode code and has restricted access to computer system resources and hardware.

In the user address space, if a user mode application attempts a read access to an invalid page of memory, an exception, e.g., a page fault, is generated by the operating system.

However, in the kernel address space, exception handlers are not used to handle exceptions, such as page faults.

Consequently, if a kernel mode application or driver attempts a read access to an invalid page of memory, an exception is generated by the operating system, and the operating system crashes on purpose.

Images